Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About nls7010
nls7010
Path Finder
Member since:
01-10-2014
02-28-2022
Community Statistics
| Posts | 111 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-10-2014 |
Activity Feed
- Posted How to pick up files in a whitelist that have a different extension on Getting Data In. 02-25-2022 10:39 AM
- Posted I am trying to bring in windows logs from a clients server, but nothing is showing. I created a new application. on Getting Data In. 11-09-2021 07:23 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-23-2021 04:28 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 11:31 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 11:12 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 10:03 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 08:39 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 08:07 AM
- Posted Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 07:26 AM
- Posted Getting the following error when trying to start a forwarder on a linux system on All Apps and Add-ons. 08-12-2021 10:41 AM
- Posted sendemail function is not working on Alerting. 05-04-2021 09:14 AM
- Tagged sendemail function is not working on Alerting. 05-04-2021 09:14 AM
- Posted send email function does not seem to be working after upgrading to version 8.1.2 on Alerting. 04-30-2021 05:45 AM
- Posted Monitoring console showing all forwarders as missing on Getting Data In. 03-04-2021 10:54 AM
- Posted How to ingest files with multiple dots in them on Getting Data In. 02-19-2021 05:40 AM
- Posted We just loaded an AIX server with a forwarder and we're getting can't write file "/.splunk/authToken_#####_8089: on Getting Data In. 12-11-2020 10:25 AM
- Posted Trying to load the Event Timeline Visualization in a clustered environment, need assistance on All Apps and Add-ons. 12-03-2020 05:14 AM
- Posted I need to bring back a zero value if my search does not bring anything back. on Splunk Search. 08-12-2020 12:06 PM
- Posted Re: Heavy forwarder - HttpClientRequest on Deployment Architecture. 08-10-2020 09:54 AM
- Posted Deployment server not deploying apps to cluster master--get does not exist on Deployment Architecture. 08-07-2020 06:51 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-15-2019
10:48 AM
The version is older, I'll download a more current one. I have eliminated the ones going to main, but I have found that those going to my new wineventlog index are not as complete as those that were going to the main index. I will look into a more current TA file for windows and download it to the search servers, then try again with what I have. I did make a change to the local copy of inputs.conf in the TA for windows I commented out all but the 3 types of logs I wanted and removed the index=wineventlog that I had placed in it as a trial to see if they would then be the full logs showing in my preferred new index. Taking it out did stop the main index from ingesting the logs. But I still don't understand why only parts of the logs show in my new index and not the full listing that was in the main index from the TA for windows.
... View more
07-15-2019
07:28 AM
The sourcetype is: Active Directory. The Application logs are going to the new index.
... View more
07-12-2019
11:23 AM
should I run the btool on one of the indexers or on the deployment server? The 2nd note above, should that be in the inputs.conf file?
... View more
07-12-2019
08:03 AM
Quick comment: I also sent out the Splunk_TA_Windows along with my new application so I'm thinking that's why some logs are going to the main index, though I noted that an index is not specified.
... View more
07-12-2019
08:01 AM
I set up a new index for one of my groups. In it they want to store their servers wineventlogs. I am unable to successfully get the logs to go to the new index. I did set up the inputs.conf file with an index=wineventlog and the index exists. There appear to be some logs showing in the new index, however they are not as full as the ones that go into the main index. I need to get all the logging into the wineventslog index and not put anything into the main index. How can I accomplish this?
My inputs.conf file:
Monitor all EAM-BOUD Windows logs
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml=false
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
index = wineventlog
renderXml=false
[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml=false
note that the wineventlog is on all 3 stanzas. I verified that the index does exist in the indexes.conf file. This in production environment so any help is greatly appreciated.
... View more
06-27-2019
12:09 PM
A customer has asked me to pick up the following logs:
%SystemRoot%\System32\Winevt\Logs\Application.evtx
%SystemRoot%\System32\Winevt\Logs\Security.evtx
%SystemRoot%\System32\Winevt\Logs\System.evtx
I am trying to figure out how to obtain those and have looked at a number of posts, but I'm not seeing what I'd like to do. Is the following possible? I want to create an inputs file as follows:
[WinEventLog://Application]
index = Winevt
sourceType = Winevt:Application
disabled = 0
[WinEventLog://Security]
index = Winevt
sourceType = Winevt:Security
disabled = 0
[WinEventLog://System]
index = Winevt
sourceType = Winevt:System
disabled = 0
But how does it know where to go for the actual files I want picked up?
Do I need to put in a full path to the logs (for instance d:/windows/events..../application.evtx)?
Any assist would be very helpful.
... View more
06-25-2019
12:10 PM
I have read all of the above, but I think I'm confused on just what to do to get the indexing going.
We are wanting to pick up the following path on some of our windows servers: %SystemRoot%\System32\Winevt\Logs\Application.evtx , but I'm not certain what to put in the sourcetype for those files.
Can I select an index rather than the main (which we don't want to use)?
Any assistance would be helpful, thank you!
... View more
06-19-2019
09:12 AM
I went in to try and rename the db buckets to the longer name for instance
db_1560844064_1560747689_41 to db_1560844064_1560747689_41_F327B74A-5619-4B29-B800-0BAF224EBDC1 ,
but I've found several of our indexes db buckets have no GUID's that I can copy from.
How to I rectify this? I have over 60 indexes that I would need to fix.
Is there another way to do this?
And how can I come up with a GUID for those db's missing that piece on all of their directories.
... View more
06-07-2019
05:52 AM
I looked through some of the answers above, but I'm not certain they fit. My clients search is:
index="websphere" sourcetype=WebSphere:SystemOutLog "execution took"| where source like "%DMAXP01%"| rex field=_raw "] (?.+) SystemOut O (?.+) \[(?.+)\] \[(?.+)\] \[(?.*)\] (?.+) - USER = \((?.+)\) SPID = \((?.+)\) app \((?.+)\) object \((?.+)\) : (?.+) \(execution took (?.+) milliseconds"| search queryString !="" | fillnull value=NULL| table ThreadId,CID_Num,host,JVMName,maxSpid,maxUser,appName,maxObject,ResponseTime_ms,queryString,_time
And he gets the error:
Getting "The XYZ query has exceeded configured match_limit, consider raising the value in limits.conf.
I note that he has the .+ entry in his search that matches one of the answers, but I'm not certain what to tell him about what to do with this search.
Should I up the limits for him or will that just make it worse?
Is there a better search?
... View more
05-29-2019
08:29 AM
A user has left our company and I need to reassign his ScheduledViews to another person.
How can I do that?
Tried the orphaned searches, but it's not really orphaned at this point.
... View more
05-08-2019
10:25 AM
For the application we created, the sourcetypes are going to the correct index. Unfortunately, the "default" container install on Diamonti, which we can't change, sends logs to the main index. So, because of that setup, I need to change on the indexers before the actual indexing is done. Since I can't control it with the app we push out to the containers, I need to have it happen once the indexers begin to receive the "default" sourcetypes from the containers.
... View more
05-02-2019
03:55 AM
Unfortunately I don't have access to the configuration on the diamonti containers so I can't put it in the inputs.conf. I have to catch these AFTER they are sent to the index (main). We have an inputs.conf on the container, but these are logs we couldn't control with inputs.conf, they are part of an automatic feed to the main index.
... View more
05-01-2019
12:41 PM
Forgot to put the 1 and 2 in the props.conf above. So I have them as 1 & 2 props and 1 & 2 transforms
... View more
05-01-2019
12:39 PM
One of my clients has an app in a container. I am unable to modify the index it goes to. I would like to put two of the sourcetypes that come from that host in a different index (by default it puts it in the main index). This is what I have so far, but wanted to know if this configuration would work:
props.conf
[mysourcetype1]
TRANSFORMS-index1 = overrideindex
[mysourcetype2]
TRANSFORMS-index1 = overrideindex
transforms.conf
[overrideindex1]
DEST_KEY = _MetaData:Index
REGEX = .
FORMAT = my_new_index
[overrideindex2]
DEST_KEY = _MetaData:Index
REGEX = .
FORMAT = my_other_new_index
... View more
03-04-2019
08:28 AM
I want to NOT ingest the events that have INFO or WARN in them. Can I use the following in the Props.conf without anything in the transforms.conf? And, of course will it work?
[type1-logs]
SEDCMD-removeINFO =s/INFO .+//g
[type2-logs]
SEDCMD-removeWARN =s/WARN .+//g
... View more
03-01-2019
07:31 AM
ok, I understand, so now I'll need to work with the client to see if everything is getting to the forwarders as needed. I did verify that the props and transform files did make it to all the indexers and the indexer cluster members were all restarted.
... View more
03-01-2019
07:29 AM
I just want the ERROR lines. So I would want to eliminate INFO, WARN, etc that are not ERROR related.
... View more
03-01-2019
07:02 AM
I am testing in my development environment and I get the same issue. Nothing gets parched out, it's all still coming into the logs. I will be working with my client in a little while to ensure the props and transforms made it to the servers (they are containers).
... View more
03-01-2019
06:44 AM
I just realized I asked that comment on the wrong value. It's the REGEX= . Is that supposed to have a value of INFO,WARN?
... View more
03-01-2019
06:27 AM
Yes, I did a rolling restart, but am still seeing INFO and WARN which I wanted to block out and only get ERROR.
... View more
02-28-2019
01:43 PM
They have all been restarted, but it's still sending the INFO and WARN messages 😞
... View more
02-28-2019
11:22 AM
we have clustered indexers and I pushed it our via the cluster master. I believe it's supposed to restart them all
... View more
02-28-2019
10:57 AM
quick question. the FORMAT key, should that be the name of the actual index in the transforms.conf file? Or it that literal? Asking because I still see the WARN and INFO logs coming in after pushing out the following:
[my1-logs]
TRANSFORMS-set = setnull, setparsing
[my2-logs]
TRANSFORMS-set = setnull, setparsing
TRANSFORMS.CONF
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = ERROR
DEST_KEY = queue
FORMAT = indexQueue
... View more
02-28-2019
09:16 AM
So, If I'm understanding this correctly, I would do something like the following:
PROPS.CONF
[value1-logs]
TRANSFORMS-set = setnull, setparsing
[value2-logs]
TRANSFORMS-set = setnull, setparsing
TRANSFORMS.CONF
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = ERROR
DEST_KEY = queue
FORMAT = indexQueue
So that only lines with ERROR will show?
... View more
02-28-2019
08:08 AM
What if there are multiple source types? I wanted to exclude those lines for the entire index which was created for this customer and they have multiple sourcetypes.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-28-2022
01:22 PM
|
